Microsoft AZ-104 Exam Dumps, Practice Test Questions

Account keys grant powerful data authorization; publishing them increases exposure and contradicts the prohibition on key-based access.

The applications need Entra data-plane authorization. Removing their roles would break authorized access without controlling legacy Shared Key calls.

Anonymous blob access bypasses the identity boundary that the policy is trying to establish. It does not disable requests signed with a storage key.

A stored access policy can revoke a service SAS bound to it; an ad hoc key-signed token with no policy relationship is unaffected. Rotating the signing key addresses that token family.

The Log action records tokens that violate the recommended interval but still allows them. It does not invalidate an otherwise valid already leaked key-signed SAS.

A key-signed SAS authorizes use of the key independently of that caller’s data-plane RBAC role. Removing Reader does not invalidate the captured signature.

Disabling one authorization mechanism does not enable public anonymous access. Anonymous access has its own account and container policy, and protected data remains protected.

A service SAS carries a signature derived from the account key even though the client presents only a token. Disabling Shared Key rejects that authorization class.

This reverses the key distinction: user delegation is secured by Entra, while service SAS uses the Shared Key method that was expressly disabled.

RegenerateKey authorizes changing key material, not the separate ARM ListKeys operation the task asks about. The custom role needs listKeys/action if retrieving account keys is explicitly permitted.

The user already has account metadata read permission. Repeating the same Action cannot satisfy a distinct list-keys operation.

Blob Data Reader permits specified blob data reads using identity, not disclosure of storage account shared keys. It does not grant listKeys/action.

Log is designed for migration, monitoring and diagnostics. With the configured logging pipeline, requests using SAS tokens that exceed the maximum can be recorded in the SAS expiry status field, but they're not denied on that basis. Keeping Log fails the requirement to prevent actual access through the overlong credential.

Blob soft delete helps recover deleted blobs during its retention window; it isn't a SAS credential-length policy engine. A caller with an otherwise valid SAS may still issue permitted reads or writes regardless of soft-delete settings. Expiry enforcement belongs to the storage account SAS expiration action.

Rotating an access key can invalidate tokens signed by that particular key, affecting legitimate clients as well; it does not establish a maximum SAS lifetime or change the current expiration action. The goal is ongoing rejection of all out-of-policy SAS requests, so use the account policy's Block action.

An abrupt prohibition can cause outages when undiscovered workloads authenticate with keys or service/account SAS. The requirement asks for safe migration as well as stronger access controls.

Rotation helps limit exposure of an existing key but perpetuates the same shared-secret pattern. Inventory legacy clients, migrate supported callers to Entra authorization, then disable Shared Key only when compatibility permits.

Giving humans additional blob data roles does not migrate running applications away from Shared Key. Inventory the callers and move supported app workloads to managed identities or Entra-based data roles before disabling Shared Key to avoid breakage.

An expiry beyond the one-hour limit would make this token violate the policy even if its start time were present. The current problem is a missing signed-start field, not insufficient remaining lifetime. Changing 30 minutes to two hours while continuing to omit `st` adds a second violation and cannot cause Block enforcement to admit the request.

SAS query fields are protected by the signature. The application's existing account-key signature was calculated from the original signed fields, so manually inserting `st` into the distributed URL does not produce a properly signed replacement credential. The producer must regenerate the complete SAS with a correct signed start and valid expiry, then distribute the new URL.

Storage Blob Data Reader grants Entra data-plane permissions to an identity, but this request is presenting an account-key-signed service SAS. Its rejection is caused by the account's SAS expiration-policy requirements, not by the consumer lacking an Entra Blob Data role. The app must reissue a policy-compliant signed token or migrate to a separate identity-based authorization model.

Key rotation limits the lifetime of leaked credentials, but the rotated account key remains a broad shared secret rather than a per-client identity with scoped Azure RBAC. Migrating to managed identities enables attribution and least privilege.

Account keys are not intrinsically one-blob delegated credentials. They are broad signing secrets and should not be distributed as though they were narrow SAS tokens.

Identity authorization can operate over private and restricted networks. Enabling public access is not a prerequisite for using an Entra principal for Blob operations.

An Azure Reader assignment is an ARM management permission and does not register a Kerberos SPN in on-premises Active Directory. The Windows client must first acquire a service ticket for the storage account's CIFS identity, and only then do share-level roles and NTFS ACLs determine data access. Changing Reader therefore leaves the specific missing-SPN authentication failure intact.

The client is mounting a file share using SMB and Kerberos, so the service principal must identify CIFS on the Azure Files endpoint. An HTTP or Blob service SPN describes a different protocol and target and will not satisfy the requested `cifs/<account>.file.core.windows.net` ticket. That mismatch would continue to cause Kerberos authentication errors even with correct network reachability.

Public network access controls which network sources may reach the storage endpoint; it does not create or repair Active Directory service principals. The stem already establishes that TCP 445 and routing work, so broadening the public endpoint could increase exposure without addressing ticket acquisition. Register the correct AD DS CIFS SPN while maintaining the restricted network posture.

This change removes a necessary SMB data-plane share permission and replaces it with management-plane read visibility. It cannot resolve a specific folder-level NTFS denial.

Key rotation changes shared-key credentials; it does not alter the NTFS ACL that denies an already authenticated user access to one directory.

Share quotas limit overall stored file capacity rather than who can traverse a specific directory. A user-specific access denial persists until the applicable NTFS security descriptors are assessed.

The explicit Reader assignment is a lower share-level permission than the configured all-authenticated-user Elevated Contributor default. Azure Files does not treat a more specific lower-privilege assignment as an overriding deny in this configuration. Expecting Reader to reduce the default would give the wrong result; to impose read-only access, the administrator must redesign the default and specific grants.

Azure Files does not inherently reject a user just because two applicable share-level permissions overlap. Its documented rule selects the higher share-level permission among the default and the specific RBAC grant. An actual deny could still arise from network, authentication or NTFS constraints, but no such conflict is described here; deleting assignments is not the required explanation.

Azure Files SMB still applies share-level authorization before directory and file ACL checks. NTFS Modify cannot simply eliminate the Azure share-level access decision, and an ACL alone cannot substitute for an appropriate share permission. In this case both layers permit modification, but the effective share-level permission comes from the higher Elevated Contributor grant rather than from the folder ACL itself.